North Korean Hackers Launder $220M from Kelp DAO Heist

A North Korean-linked hacking group has laundered nearly all of the accessible funds stolen from the Kelp DAO protocol in a major security breach earlier this year, leaving investigators with a drastically narrowed path for recovery. According to blockchain intelligence data, approximately $220 million in unfrozen assets has been moved through privacy-focused services, with only about $1.7 million remaining in the original attacker-controlled wallets.

The exploit occurred on April 18, 2026, when attackers drained roughly $292 million from Kelp DAO's cross-chain bridge infrastructure. Investigators attributed the attack to TraderTraitor, a state-sponsored cybercrime group also known as UNC4899, which is part of the Lazarus ecosystem. The group exploited a vulnerability in Kelp DAO's specific implementation of a LayerZero bridge, which relied on a single verification node contrary to security recommendations.

The laundering operation unfolded over approximately six weeks. Analysts report the funds were processed in two primary stages: first converted to Bitcoin and obscured using the Wasabi CoinJoin mixer, then returned to the Ethereum network and channeled through the Tornado...